{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5123", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2023-09-22T14:37:00.387Z", "datePublished": "2024-02-14T15:06:11.126Z", "dateUpdated": "2025-03-24T19:13:31.690Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "grafana-json-datasource", "repo": "https://github.com/grafana/grafana-json-datasource", "vendor": "Grafana", "versions": [{"lessThan": "1.3.21", "status": "affected", "version": "0.2.0", "versionType": "semver"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "To be exposed to the full risk of this vulnerability, an administrator must have installed this plugin and configured it to send requests back to the Grafana API, with a subpath constraint set to prevent requests to administrative API endpoints.<br>"}], "value": "To be exposed to the full risk of this vulnerability, an administrator must have installed this plugin and configured it to send requests back to the Grafana API, with a subpath constraint set to prevent requests to administrative API endpoints."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<table><tbody><tr><td>The JSON datasource plugin (<a target=\"_blank\" rel=\"nofollow\" href=\"https://grafana.com/grafana/plugins/marcusolsson-json-datasource/\">https://grafana.com/grafana/plugins/marcusolsson-json-datasource/</a>) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path. </td>\n</tr>\n\n\n\n\n <tr>\n </tr></tbody></table>\n <table><tbody><tr><td> <br></td>\n</tr>\n\n\n\n\n <tr>\n </tr></tbody></table>\n This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g. <a target=\"_blank\" rel=\"nofollow\" href=\"https://example.com/api/some_safe_api/\">https://example.com/api/some_safe_api/</a>), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g. <a target=\"_blank\" rel=\"nofollow\" href=\"https://example.com/api/admin_api/)\">https://example.com/api/admin_api/)</a>.<br><br>In the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability.<br>"}], "value": "The JSON datasource plugin ( https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ ) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path. \n\n\n\n\n\n \n \n \n\n\n\n\n\n\n \n \n This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g. https://example.com/api/some_safe_api/ ), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g. https://example.com/api/admin_api/) .\n\nIn the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2025-01-10T12:16:49.682Z"}, "references": [{"url": "https://grafana.com/security/security-advisories/cve-2023-5123/"}, {"url": "https://security.netapp.com/advisory/ntap-20240503-0007/"}], "source": {"discovery": "EXTERNAL"}, "title": "Improper Path Sanitization in JSON Datasource Plugin", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:44:53.814Z"}, "title": "CVE Program Container", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2023-5123/", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240503-0007/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-02-15T18:25:00.545447Z", "id": "CVE-2023-5123", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-24T19:13:31.690Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2023-5123/", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240503-0007/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:44:53.814Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-5123", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-15T18:25:00.545447Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-24T19:13:25.086Z"}}], "cna": {"title": "Improper Path Sanitization in JSON Datasource Plugin", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/grafana/grafana-json-datasource", "vendor": "Grafana", "product": "grafana-json-datasource", "versions": [{"status": "affected", "version": "0.2.0", "lessThan": "1.3.21", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2023-5123/"}, {"url": "https://security.netapp.com/advisory/ntap-20240503-0007/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The JSON datasource plugin ( https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ ) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path. \n\n\n\n\n\n \n \n \n\n\n\n\n\n\n \n \n This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g. https://example.com/api/some_safe_api/ ), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g. https://example.com/api/admin_api/) .\n\nIn the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "<table><tbody><tr><td>The JSON datasource plugin (<a target=\"_blank\" rel=\"nofollow\" href=\"https://grafana.com/grafana/plugins/marcusolsson-json-datasource/\">https://grafana.com/grafana/plugins/marcusolsson-json-datasource/</a>) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path. </td>\n</tr>\n\n\n\n\n <tr>\n </tr></tbody></table>\n <table><tbody><tr><td> <br></td>\n</tr>\n\n\n\n\n <tr>\n </tr></tbody></table>\n This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g. <a target=\"_blank\" rel=\"nofollow\" href=\"https://example.com/api/some_safe_api/\">https://example.com/api/some_safe_api/</a>), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g. <a target=\"_blank\" rel=\"nofollow\" href=\"https://example.com/api/admin_api/)\">https://example.com/api/admin_api/)</a>.<br><br>In the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "configurations": [{"lang": "en", "value": "To be exposed to the full risk of this vulnerability, an administrator must have installed this plugin and configured it to send requests back to the Grafana API, with a subpath constraint set to prevent requests to administrative API endpoints.", "supportingMedia": [{"type": "text/html", "value": "To be exposed to the full risk of this vulnerability, an administrator must have installed this plugin and configured it to send requests back to the Grafana API, with a subpath constraint set to prevent requests to administrative API endpoints.<br>", "base64": false}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2025-01-10T12:16:49.682Z"}}}, "cveMetadata": {"cveId": "CVE-2023-5123", "state": "PUBLISHED", "dateUpdated": "2025-03-24T19:13:31.690Z", "dateReserved": "2023-09-22T14:37:00.387Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2024-02-14T15:06:11.126Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "The JSON datasource plugin ( https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ ) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path. \n\n\n\n\n\n \n \n \n\n\n\n\n\n\n \n \n This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g. https://example.com/api/some_safe_api/ ), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g. https://example.com/api/admin_api/) .\n\nIn the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability."}, {"lang": "es", "value": "El complemento de fuente de datos JSON (https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ https://grafana.com/grafana/plugins/marcusolsson-json-datasource/) es un complemento mantenido por Grafana Labs para Grafana que permite recuperar y procesar datos JSON desde un endpoint remoto (incluida una subruta espec\u00edfica) configurado por un administrador. Debido a una sanitizaci\u00f3n inadecuada del par\u00e1metro de ruta proporcionado por el panel, fue posible incluir caracteres de path traversal (../) en el par\u00e1metro de ruta y enviar solicitudes a rutas en el endpoint configurado fuera de la subruta configurada. Esto significa que si un administrador configur\u00f3 la fuente de datos para que apunte a alguna subruta de un dominio (por ejemplo, https://example.com/api/some_safe_api/ https://example.com/api/some_safe_api/), Era posible que un editor creara un panel que hiciera referencia a la fuente de datos y que emitiera consultas que contuvieran caracteres de path traversal, lo que a su vez causar\u00eda que la fuente de datos consultara subrutas arbitrarias en el dominio configurado (por ejemplo, https://example.com/api/admin_api/ ) https://example.com/api/admin_api/). En el raro caso de que un administrador configure este complemento para apuntar a la propia instancia de Grafana, esta vulnerabilidad se vuelve considerablemente m\u00e1s grave, ya que un administrador que navega por un panel configurado maliciosamente podr\u00eda verse obligado a realizar solicitudes a los endpoints de la API administrativa de Grafana con sus credenciales, lo que genera la posibilidad de una escalada de privilegios, de ah\u00ed la puntuaci\u00f3n alta para esta vulnerabilidad."}], "id": "CVE-2023-5123", "lastModified": "2024-11-21T08:41:06.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "security@grafana.com", "type": "Secondary"}]}, "published": "2024-02-14T15:15:08.620", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2023-5123/"}, {"source": "security@grafana.com", "url": "https://security.netapp.com/advisory/ntap-20240503-0007/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://grafana.com/security/security-advisories/cve-2023-5123/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20240503-0007/"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@grafana.com", "type": "Secondary"}]}

{}